All CVEs — page 435 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw allows unauthenticated attackers to perform Stored Cross-Site Scripting (XSS) attacks by injecting malicious scripts through the email-locked download subscription form, which could lead to data exfiltration, information disclosure, and potential administrative control.
The Ad Inserter WordPress plugin allows any logged-in user, including subscribers, to access a settings page that doesn't properly filter saved content, enabling stored XSS or code execution. This represents a significant privilege escalation and potential RCE vector.
The flaw allows authenticated users to execute arbitrary Python and OS commands, posing a significant risk due to insufficient sandboxing of workflow condition expressions.
This vulnerability allows authenticated users to execute arbitrary Python code through the expression engine's DotList map/filter and fallback resolver, posing a significant risk due to the potential for remote code execution.